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Claims 

What is claimed is: 

1 . A method for dynamic rules-based peg counting comprising: 

(a) at a plurality of signaling message site collectors, generating 
5 peg counter instances by comparing monitored signaling 

messages to existing peg counter definitions, each peg counter 
instance including an accumulator value indicating a number of 
the signaling messages that match one of the existing peg 
counter definitions and an identifier for identifying the 
10 associated peg counter definition; 

(b) receiving new peg counter definitions; and 

(c) in response to receiving the new peg counter definitions, 
switching to the new peg counter definitions on the fly and 
generating peg counter instances based on the new peg 

1 5 counter definitions. 

2. The method of claim 1 wherein generating peg counter instances 
includes: 

(a) determining whether a monitored signaling message matches 
one of the peg counter definitions; 
20 (b) in response to determining that a monitored signaling message 

matches one of the peg counter definitions, determining 
whether a peg counter instance exists for the matching peg 
counter definition; and 
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(c) in response to determining that a peg counter instance exists, 
incrementing an accumulator value associated with the peg 
counter instance. 

3. The method of claim 2 comprising, in response to determining that a 
5 peg counter instance does not exist, creating a new peg counter 

instance for the matching peg counter definition and incrementing an 
accumulator value associated with the peg counter instance. 

4. The method of claim 2 wherein determining whether a peg counter 
instance exists includes determining a peg counter identifier 

10 corresponding to the matching peg counter definition and searching 

for a peg counter instance having the peg counter identifier. 

5. The method of claim 1 wherein the peg counter definitions include 
rules for generating peg counter instances based on SS7 messages. 

6. The method of claim 1 wherein the peg counter definitions include 
15 rules for generating peg counter instances based on Internet 

Engineering Task Force SIGTRAN signaling messages. 

7. The method of claim 1 wherein the peg counter definitions include 
rules for generating peg counter instances based on IP telephony 
signaling messages. 

20 8. The method of claim 1 comprising creating the new peg counter 
definitions using a rules-based language. 
9. The method of claim 8 wherein creating the new peg counter 
definitions using a rules-based language includes presenting a user 
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with lists of messages and message parameters and receiving input 
from the user regarding messages, message parameters, and values 
for the message parameters. 

10. The method of claim 9 wherein creating the new peg counter 
definitions using a rules-based language includes presenting the user 
with comparator choices for comparing the message parameters to 
the message parameter values to create message parameter 
comparison equations and presenting the user with logical operators 
for combining the message parameter comparison equations and 
thereby creating a peg counter definition. 

11. The method of claim 1 wherein receiving the new peg counter 
definitions includes: 

(a) writing the new peg counter definitions to a database at an 
administration server; 

(b) downloading the peg counter definitions to databases at the 
site collectors; 

(c) notifying the site collectors of a change in their respective 
databases; and 

(d) at the site collectors, in response to receiving the notification, 
loading the new peg counter definitions into program memory. 

12. The method of claim 1 wherein switching to the new peg counter 
definitions on the fly includes switching to the new peg counter 
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definitions without modifying or re-compiling computer code executing 
on the site collectors for generating the peg counter instances. 

13. The method of claim 1 comprising transmitting the peg counter 
instances from the site collectors to a data gateway server. 

14. The method of claim 13 comprising, at the data gateway server, 
aggregating the peg counter instances from the site collectors to form 
system wide peg counter instances. 

15. The method of claim 14 wherein aggregating the peg counter 
instances includes: 

(a) receiving a first peg counter instance from a first site collector, 
the first peg counter instance having a first peg counter 
identifier, a first timestamp, and a first accumulator value; 

(b) searching for a peg counter instance having the first peg 
counter identifier and the first timestamp; and 

(c) in response to locating a peg counter instance having the first 
peg counter identifier and the first timestamp, adding the first 
accumulator value to an accumulator value associated with the 
peg counter instance. 

16. The method of claim 15 comprising, in response to failing to locate a 
peg counter instance having the first peg counter identifier and the 
first timestamp, storing the first peg counter instance as a new peg 
counter instance in a peg counter database. 
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17. A system for dynamic rules-based peg counting, the system 
comprising: 

(a) a plurality of site collectors for receiving signaling messages 
and for generating peg counter instances based on the 
signaling messages matching existing peg counter definitions, 
the peg counter instances each including an accumulator value 
indicating a number of signaling messages matching one of the 
peg counter definitions and an identifier for identifying the 
associated peg counter definition; and 

(b) an administration server operatively associated with the site 
collectors for receiving new peg counter definitions from a user 
and for communicating the new peg counter definitions to the 
site collectors, wherein, in response to receiving the new peg 
counter definitions, the site collectors are adapted to switch to 
the new peg counter definitions on the fly and to generate peg 
counter instances based on the new peg counter definitions. 

18. The system of claim 17 wherein the site collectors are adapted to 
generate peg counter instances based on SS7 signaling messages 
sent over SS7 signaling links. 

19. The system of claim 17 wherein the site collectors are adapted to 
generate peg counter instances based on Internet Engineering Task 
Force SIGTRAN signaling messages sent over IP signaling links. 
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20. The system of claim 17 wherein the site collectors are adapted to 
generate peg counter instances based on IP telephony signaling 
messages sent over IP signaling links. 

21. The system of claim 17 wherein the site collectors are adapted to 
receive the signaling messages from signaling link probes. 

22. The system of claim 17 wherein the site collectors are adapted to 
receive the signaling messages form message copy functions internal 
to a signaling node. 

23. The system of claim 17 wherein the administration server is adapted 
to provide a rules-based language to the user for creating the peg 
counter definitions. 

24. The system of claim 23 wherein the rules-based language includes 
message type identifiers, message parameter identifiers, comparators 
for creating message parameter comparison equations, and logical 
operators for combining the message parameter comparison 
equations. 

25. The system of claim 17 wherein the administration server is adapted 
to download the new peg counter definitions to the site collectors and 
notify the site collectors of the presence of the new peg counter 
definitions. 

26. The system of claim 17 comprising a data gateway server operatively 
associated with the site collectors and a plurality of applications, 



Atty. Docket No.: 1322/122/2 

-35- 



wherein the site collectors are adapted to upload the peg counter 
instances to the data gateway server at predetermined intervals. 

27. The system of claim 26 wherein the data gateway server is adapted to 
aggregate the peg counter instances received from the site collectors 
and to generate application-specific peg counter instances in 
response to application-specific peg counter requests. 

28. A computer program product comprising computer executable 
instructions embodied in a computer readable medium for performing 
steps comprising: 

(a) presenting the user with a computer based graphical template 
for defining a peg counter; 

(b) receiving input from the user via the template regarding 
parameter values to be extracted from received signaling 
messages; 

(c) receiving input from the user via the template regarding values 
to be compared with the extracted parameter values; 

(d) receiving input from the user via the template regarding 
equations for comparing the extracted parameter values to the 
values specified in step (c) ; and 

(e) receiving input from the user via the template regarding logical 
operators for combining equations to form a definition for the 
peg counter. 
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29. The computer program product of claim 28 wherein presenting the 
user with a computer based graphical template for defining a peg 
counter includes presenting the user with a computer based graphical 
template including menus for selecting the parameters and logical 
operators. 

30. The computer program product of claim 28 wherein receiving input 
from the user regarding parameter values to be extracted from 
received messages includes presenting the user with a menu of 
parameter names corresponding to a message type for the peg 
counter and allowing the user to select parameter names from the list. 

31. The computer program product of claim 28 wherein receiving input 
from the user regarding parameter values to be compared with the 
extracted parameter values includes presenting the user with an input 
field for allowing the user to input parameter values. 

32. The computer program product of claim 28 wherein receiving input 
from the user regarding parameter values to be compared with the 
extracted parameter values includes presenting the user with a menu 
of parameter value lists and receiving input from the user regarding 
one of the parameter value lists. 

33. The computer program product of claim 28 wherein receiving input 
from the user regarding equations includes presenting the user with a 
menu of comparators and allowing the user to select comparators 
from the menu. 
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34. The computer program product of claim 28 wherein receiving input 
from the user regarding logical operators includes presenting the user 
with a menu including AND-based and OR-based operators and 
receiving input from the user regarding operators for combining the 
equations. 

35. The computer program product of claim 28 comprising storing the peg 
counter definition in a database. 

36. The computer program product of claim 28 comprising distributing the 
peg counter definition from an administration server to a plurality of 
network monitoring site collectors. 

37. The computer program product of claim 36 comprising notifying the 
site collectors of the peg counter definition. 



